feat(postbox): add governed DSAR coverage

README.md

@@ -135,6 +135,23 @@ envelope changes use the Encryption migration ledger. Any transition to or from
 E2EE waits for client-supplied transforms for historical messages; the module
 does not claim or silently simulate native browser/device key custody.
 
+## Data-subject requests
+
+Postbox contributes a tenant-isolated provider to the Core data-subject request
+workflow. It finds bounded personal message, participant, receipt, grouping,
+access, configuration-authorship, and content-protection metadata. It never
+decrypts or exports ciphertext, envelopes, wrapped keys, external-recipient
+tokens, opaque metadata, or unrelated participant data. Institutional delivery,
+routing, acknowledgement, access, template, and protection-transition evidence
+is retained with an explicit reason and message content remains subject to
+manual records and third-party privacy review.
+
+Personal unified-inbox groupings are the one directly executable erasure
+operation. Execution revalidates tenant, subject ownership, and the grouping
+revision, then deletes only the personal projection and its source preferences;
+source Postboxes and messages are unchanged. Files attachments, producer
+records, identities, and function assignments remain with their owning modules.
+
 Run focused checks with:
 
 ```bash